A growing library of browser tools and deep technical guides for IT professionals.
DNS, certificates, ports, and everything else about how a request actually gets from A to B.
Look up A, AAAA, CNAME, MX, TXT, NS, SOA, CAA, SRV, DMARC, and DKIM (with an optional selector) records for any hostname or IP, against Cloudflare, Google, Quad9, or a custom resolver — with TTL, response time, per-record copy, and JSON export. Requires a live network request.
Compare what Cloudflare, Google, and Quad9's public resolvers currently return for a hostname, side by side, with TTL and response time per resolver and mismatches highlighted. Requires a live network request.
Paste a BIND-style DNS zone file and validate SOA/NS/MX/A/AAAA/TXT/CNAME/CAA/SRV/PTR records — duplicate detection, TTL inconsistencies, missing/invalid SOA, invalid hostnames, unsupported directives. No live DNS queries. Runs entirely in your browser.
Look up a domain's registrar, creation/updated/expiry dates, status codes, and nameservers by following the real IANA WHOIS referral chain, with the full raw response and a privacy-redaction indicator. Requires a live network request.
Enter an IPv4 address and CIDR prefix to get the subnet mask, network/broadcast addresses, usable host range, and address count. Runs entirely in your browser.
Look up the vendor/manufacturer of a MAC address using the official IEEE OUI registry (53,000+ assignments). Runs entirely in your browser.
Searchable TCP/UDP port reference — 51 common ports with default service, description, security notes, and typical attack relevance, filterable by category (Windows, Linux, Database, Web, Authentication, File Sharing). Runs entirely in your browser.
Inspect a live server's real TLS certificate chain — subject, issuer, SAN entries, validity, fingerprints, and flags for expired, self-signed, weak-key, or hostname-mismatched certificates. Requires a live network request.
Inspect a URL's response headers, status, redirect chain, cookies, cache headers, compression, and which common security headers are missing — each one explained in plain English. Requires a live network request.
Follow a URL's full redirect chain step by step, with status codes, warnings for redirect loops, excessive hops, and HTTP/HTTPS scheme changes. Requires a live network request.
Grades a URL's HTTP security headers (HSTS, CSP, X-Frame-Options, Permissions-Policy, and the cross-origin trio) against OWASP's own baseline, with a plain-English explanation of what each one protects against and why a missing one matters.
Break any URL down into protocol, credentials, hostname, port, path, filename, extension, query parameters, and fragment, with decoded/normalized/punycode views and highlights for duplicate, empty, overlong, or suspiciously-encoded parameters. Runs entirely in your browser.
Fetch and validate a site's robots.txt and sitemap.xml — rules by user-agent, sitemap URL counts/priority/last-modified, and detection of malformed XML, missing files, and oversized sitemaps. Requires a live network request.
Decoding the cryptic numbers Windows hands you — error codes, event IDs, and beyond.
Look up Win32 errors, NTSTATUS values, and HRESULT codes in one search — auto-detects hex, decimal, or symbolic name, and decodes an HRESULT's severity/facility/code bits (resolving the common Win32-wrapped case automatically). Runs entirely in your browser.
Offline reference for 28 Windows Security/System event IDs that come up constantly in real investigations — search by ID, keyword, or category, with typical meaning, severity guidance, investigation steps, and MITRE ATT&CK mappings. Runs entirely in your browser.
A reference for translating common commands between Bash/Linux, Windows CMD, and PowerShell — closest equivalents, real syntax differences, and platform limitations, without pretending commands are identical when they're not. Runs entirely in your browser.
Convert between numeric (750, 4755), permission-string (rwxr-x---), full ls -l style (-rwsr-xr-x), and chmod's own u+rwx,g+rx,o-rwx operator syntax — plus checkboxes, setuid/setgid/sticky, contextual warnings, and generated chmod/chmod -R/chown/chgrp commands. Runs entirely in your browser.
Permissions, scheduled jobs, services, and the shell commands that tie it all together.
Convert between numeric (750, 4755), permission-string (rwxr-x---), full ls -l style (-rwsr-xr-x), and chmod's own u+rwx,g+rx,o-rwx operator syntax — plus checkboxes, setuid/setgid/sticky, contextual warnings, and generated chmod/chmod -R/chown/chgrp commands. Runs entirely in your browser.
Reference and calculator for Linux capabilities — search by name, number, or use case, select several, and get the real numeric/hex bitmask, a setcap command, and systemd CapabilityBoundingSet=/AmbientCapabilities= examples. Runs entirely in your browser.
Build a standard 5-field cron expression visually or by hand, validate it, and preview the next 10 actual run times in your browser's local timezone. Runs entirely client-side.
Paste a 5-field cron expression and get a plain-English, field-by-field explanation. Runs entirely in your browser.
Paste a systemd unit file (.service/.timer/.socket/.mount/.path/.target) and get a directive-by-directive explanation, plus real validation — unknown directives, duplicate assignments, ExecStart misuse for the declared Type=, missing hardening, and more. Runs entirely in your browser.
Breaks down a shell command into its syntax, what each command and flag actually does, and a plain-English summary of what the whole thing will do. Runs entirely in your browser.
A reference for translating common commands between Bash/Linux, Windows CMD, and PowerShell — closest equivalents, real syntax differences, and platform limitations, without pretending commands are identical when they're not. Runs entirely in your browser.
Paste or upload logs in plain text, JSON Lines, key-value, syslog, Apache/Nginx, or delimited format — auto-detects the format, extracts fields into a searchable/filterable table, and exports what you need. A general troubleshooting utility, not just a security tool. Runs entirely in your browser.
Extract and normalize timestamps from pasted log lines — detects ISO 8601, Unix epoch (s/ms/us), Apache/Nginx, syslog, RFC 2822, and common database formats, converts between timezones, and flags ambiguous dates instead of silently guessing. Runs entirely in your browser.
Build a reorderable pipeline of text-cleanup operations — trim, dedupe, sort, case conversion, ANSI stripping, regex replace, and more — with a live before/after preview. Order matters and is fully under your control. Never interprets input as HTML or executes it. Runs entirely in your browser.
No dedicated Docker/Kubernetes tools exist yet — this collection is the general-purpose tools that come up most while working with containers: logs, YAML, and shell commands.
Pretty-print, minify, and validate YAML with real line/column error messages, and convert between YAML and JSON — supports multi-document files, anchors, aliases, and multiline strings. Runs entirely in your browser.
Paste JSON to validate, pretty-print, or minify it. Runs entirely in your browser — nothing is sent anywhere.
Paste or upload logs in plain text, JSON Lines, key-value, syslog, Apache/Nginx, or delimited format — auto-detects the format, extracts fields into a searchable/filterable table, and exports what you need. A general troubleshooting utility, not just a security tool. Runs entirely in your browser.
Breaks down a shell command into its syntax, what each command and flag actually does, and a plain-English summary of what the whole thing will do. Runs entirely in your browser.
Build a standard 5-field cron expression visually or by hand, validate it, and preview the next 10 actual run times in your browser's local timezone. Runs entirely client-side.
The everyday data-wrangling tools: formatters, encoders, generators, and testers.
Paste JSON to validate, pretty-print, or minify it. Runs entirely in your browser — nothing is sent anywhere.
Test JSONPath expressions against real JSON — live matching, matched-value highlighting, and a results list with copyable paths and values. Supports dot/bracket notation, wildcards, slices, recursive descent, and filter expressions. Runs entirely in your browser.
A client-side jq-like expression playground — field selection, pipes, object/array construction, map(), select(), sort_by(), group_by(), and more, evaluated by a hand-written interpreter (no WASM, no server). Shows parsed output, errors, and execution time. Runs entirely in your browser.
Pretty-print, minify, and validate XML, then run XPath queries against it with match counts and node previews — namespace-aware, with verified protection against XXE and entity-expansion attacks. Runs entirely in your browser.
Pretty-print, minify, and validate YAML with real line/column error messages, and convert between YAML and JSON — supports multi-document files, anchors, aliases, and multiline strings. Runs entirely in your browser.
Pretty-print or minify SQL, force keyword case, and pick an indent size — dialect-aware keyword recognition for generic SQL, PostgreSQL, MySQL, SQLite, and SQL Server. Formatting only, never executes anything. Runs entirely in your browser.
Test a regular expression against sample text with live match highlighting and capture groups, plus a plain-English breakdown of every character class, group, quantifier, assertion, and flag — with a catastrophic-backtracking heuristic warning. Runs entirely in your browser.
Compare two blocks of text line by line and see exactly what was added, removed, or changed. Runs entirely in your browser.
Generate RFC 4122 version 4 (random) UUIDs using the browser's built-in cryptographically secure generator. Runs entirely in your browser.
Encode or decode Base64, with correct Unicode/UTF-8 handling — plain btoa/atob breaks on non-Latin1 text. Runs entirely in your browser.
Encode or decode URL text, with a choice between component encoding (query params) and full-URI encoding. Runs entirely in your browser.
Paste a full URL or just a query string and edit its parameters in a table — add, delete, duplicate, reorder, sort, and see both the encoded and decoded value of each. Handles repeated keys and warns on malformed percent-encoding. Runs entirely in your browser.
Decode a JSON Web Token's header and payload, with human-readable timestamps for exp/iat/nbf. Runs entirely in your browser — does not verify the signature.
Generate SHA-1, SHA-256, SHA-384, and SHA-512 hashes of text using the browser's native Web Crypto API. Runs entirely in your browser.
Paste or upload a CSV file and get an interactive, searchable, sortable table — auto-detected delimiter and header, malformed/duplicate row detection, per-column stats, and CSV/JSON conversion. Large files are parsed in a Web Worker so the page doesn't freeze. Runs entirely in your browser.
Convert colors between HEX, RGB, and HSL, with a live preview swatch. Runs entirely in your browser.
Convert between Unix epoch timestamps and human-readable dates, shown in both UTC and your browser's local time explicitly. Runs entirely in your browser.
Paste a 5-field cron expression and get a plain-English, field-by-field explanation. Runs entirely in your browser.
Build a standard 5-field cron expression visually or by hand, validate it, and preview the next 10 actual run times in your browser's local timezone. Runs entirely client-side.
Convert images between PNG, JPEG, and WebP, and resize them, entirely in your browser using the Canvas API. Nothing is uploaded anywhere.
Inspecting how a website or API actually behaves from the outside.
Inspect a URL's response headers, status, redirect chain, cookies, cache headers, compression, and which common security headers are missing — each one explained in plain English. Requires a live network request.
Follow a URL's full redirect chain step by step, with status codes, warnings for redirect loops, excessive hops, and HTTP/HTTPS scheme changes. Requires a live network request.
Inspect a live server's real TLS certificate chain — subject, issuer, SAN entries, validity, fingerprints, and flags for expired, self-signed, weak-key, or hostname-mismatched certificates. Requires a live network request.
Grades a URL's HTTP security headers (HSTS, CSP, X-Frame-Options, Permissions-Policy, and the cross-origin trio) against OWASP's own baseline, with a plain-English explanation of what each one protects against and why a missing one matters.
Break any URL down into protocol, credentials, hostname, port, path, filename, extension, query parameters, and fragment, with decoded/normalized/punycode views and highlights for duplicate, empty, overlong, or suspiciously-encoded parameters. Runs entirely in your browser.
Offline reference for all 62 IANA-registered HTTP status codes — search by code, name, category, or keyword, with RFC references, causes, fixes, a troubleshooting checklist per status class, and — for the codes people mix up most (401/403, 301/302/307/308, 409/422, 500/502/503/504) — reverse-proxy/gateway context, API-client notes, and browser-specific behavior. Runs entirely in your browser.
Offline reference for 45 common file formats, plus optional local file inspection — drag in a real file (or paste hex bytes) and this identifies its actual format from its magic bytes, flags an extension mismatch, and inspects ZIP-based container formats (docx/xlsx/pptx/jar/apk) by their real entry names. Runs entirely in your browser; your file is not uploaded.
Parse one or many User-Agent strings into browser, engine, OS, device type, and CPU architecture — flags automation frameworks (curl, PowerShell, Python Requests, Headless Chrome, Selenium, and more) and obsolete browsers, with a confidence rating per result. Runs entirely in your browser.
Build (or decode) Basic, Bearer, and API-key Authorization headers. Secrets are hidden by default with a reveal toggle, never saved to local storage, never put in a URL, and never sent anywhere. Runs entirely in your browser.
Grab a full-page screenshot of any public URL, right in your browser. Powered by thum.io's free screenshot service.
Fetch and validate a site's robots.txt and sitemap.xml — rules by user-agent, sitemap URL counts/priority/last-modified, and detection of malformed XML, missing files, and oversized sitemaps. Requires a live network request.
Paste a full URL or just a query string and edit its parameters in a table — add, delete, duplicate, reorder, sort, and see both the encoded and decoded value of each. Handles repeated keys and warns on malformed percent-encoding. Runs entirely in your browser.
Triage tools for indicators, credentials, and files you don't yet trust.
Check an IP address, file hash, URL, or domain against VirusTotal, AbuseIPDB, AlienVault OTX, GreyNoise, and abuse.ch's ThreatFox/URLhaus/MalwareBazaar in one place.
Pull IPs, domains, URLs, emails, hashes, CVEs, ATT&CK IDs, and file/registry paths out of a pasted alert, ticket, or log — grouped, deduplicated, and exportable. Runs entirely in your browser.
Safely defang IOCs (URLs, domains, IPs, emails) so they can be pasted into tickets and chat without becoming clickable, or refang them back. Runs entirely in your browser.
Decode a JSON Web Token's header and payload, with human-readable timestamps for exp/iat/nbf. Runs entirely in your browser — does not verify the signature.
Generate SHA-1, SHA-256, SHA-384, and SHA-512 hashes of text using the browser's native Web Crypto API. Runs entirely in your browser.
Inspect a live server's real TLS certificate chain — subject, issuer, SAN entries, validity, fingerprints, and flags for expired, self-signed, weak-key, or hostname-mismatched certificates. Requires a live network request.
Grades a URL's HTTP security headers (HSTS, CSP, X-Frame-Options, Permissions-Policy, and the cross-origin trio) against OWASP's own baseline, with a plain-English explanation of what each one protects against and why a missing one matters.
Paste a BIND-style DNS zone file and validate SOA/NS/MX/A/AAAA/TXT/CNAME/CAA/SRV/PTR records — duplicate detection, TTL inconsistencies, missing/invalid SOA, invalid hostnames, unsupported directives. No live DNS queries. Runs entirely in your browser.
Drag in a Windows PE (EXE/DLL) file and inspect its real structure locally — architecture, sections, entry point, imports, exports, characteristics, optional header, version info, and digital-signature presence, plus packed/suspicious-section observations. Never executes or uploads the file. Runs entirely in your browser.
Load a PCAP or PCAPNG file and get an offline summary — capture duration, protocol breakdown, top conversations, IPv4/IPv6 and TCP/UDP/ICMP counts, DNS query names, HTTP Host headers, and TLS SNI values. No session reconstruction, no deep payload decoding. Runs entirely in your browser.
Parse and classify authentication events from Linux SSH logs, Windows sign-in event exports, and generic JSON/key-value application or VPN logs — success/failure breakdowns, most-active users, and pattern observations phrased as observations, not verdicts. Runs entirely in your browser.
Parse iptables/nftables, UFW, Windows Firewall, and pf logs (plus generic CSV/key-value firewall exports) into a searchable table with top-talkers, blocked-port, and blocked-destination summaries, CIDR-aware filtering, and neutral observations — denied traffic isn't automatically called malicious. Runs entirely in your browser.
Paste full email headers to extract the common fields, walk the Received chain in true chronological order with hop delays, flag private IPs and hostname mismatches, check SPF/DKIM/DMARC results, and pull out every IOC. Runs entirely in your browser.
Log analysis and timeline-building for incident investigation.
Drag in a Windows PE (EXE/DLL) file and inspect its real structure locally — architecture, sections, entry point, imports, exports, characteristics, optional header, version info, and digital-signature presence, plus packed/suspicious-section observations. Never executes or uploads the file. Runs entirely in your browser.
Load a PCAP or PCAPNG file and get an offline summary — capture duration, protocol breakdown, top conversations, IPv4/IPv6 and TCP/UDP/ICMP counts, DNS query names, HTTP Host headers, and TLS SNI values. No session reconstruction, no deep payload decoding. Runs entirely in your browser.
Paste or upload logs in plain text, JSON Lines, key-value, syslog, Apache/Nginx, or delimited format — auto-detects the format, extracts fields into a searchable/filterable table, and exports what you need. A general troubleshooting utility, not just a security tool. Runs entirely in your browser.
Extract and normalize timestamps from pasted log lines — detects ISO 8601, Unix epoch (s/ms/us), Apache/Nginx, syslog, RFC 2822, and common database formats, converts between timezones, and flags ambiguous dates instead of silently guessing. Runs entirely in your browser.
Parse and classify authentication events from Linux SSH logs, Windows sign-in event exports, and generic JSON/key-value application or VPN logs — success/failure breakdowns, most-active users, and pattern observations phrased as observations, not verdicts. Runs entirely in your browser.
Parse iptables/nftables, UFW, Windows Firewall, and pf logs (plus generic CSV/key-value firewall exports) into a searchable table with top-talkers, blocked-port, and blocked-destination summaries, CIDR-aware filtering, and neutral observations — denied traffic isn't automatically called malicious. Runs entirely in your browser.
Build a chronological timeline for any kind of investigation or troubleshooting — an outage, a deployment problem, a security incident, an authentication issue. Manual entries, CSV/JSON import, and imports from other Toolshed tools, with duplicate and timestamp-conflict detection, UTC normalization, and Markdown/CSV/JSON export. Session-only by default. Runs entirely in your browser.
Pull IPs, domains, URLs, emails, hashes, CVEs, ATT&CK IDs, and file/registry paths out of a pasted alert, ticket, or log — grouped, deduplicated, and exportable. Runs entirely in your browser.
Check an IP address, file hash, URL, or domain against VirusTotal, AbuseIPDB, AlienVault OTX, GreyNoise, and abuse.ch's ThreatFox/URLhaus/MalwareBazaar in one place.
Paste full email headers to extract the common fields, walk the Received chain in true chronological order with hop delays, flag private IPs and hostname mismatches, check SPF/DKIM/DMARC results, and pull out every IOC. Runs entirely in your browser.
Parse one or many User-Agent strings into browser, engine, OS, device type, and CPU architecture — flags automation frameworks (curl, PowerShell, Python Requests, Headless Chrome, Selenium, and more) and obsolete browsers, with a confidence rating per result. Runs entirely in your browser.
Build a reorderable pipeline of text-cleanup operations — trim, dedupe, sort, case conversion, ANSI stripping, regex replace, and more — with a live before/after preview. Order matters and is fully under your control. Never interprets input as HTML or executes it. Runs entirely in your browser.
Fast lookups for the questions that come in every day.
Look up Win32 errors, NTSTATUS values, and HRESULT codes in one search — auto-detects hex, decimal, or symbolic name, and decodes an HRESULT's severity/facility/code bits (resolving the common Win32-wrapped case automatically). Runs entirely in your browser.
Offline reference for 28 Windows Security/System event IDs that come up constantly in real investigations — search by ID, keyword, or category, with typical meaning, severity guidance, investigation steps, and MITRE ATT&CK mappings. Runs entirely in your browser.
Convert between numeric (750, 4755), permission-string (rwxr-x---), full ls -l style (-rwsr-xr-x), and chmod's own u+rwx,g+rx,o-rwx operator syntax — plus checkboxes, setuid/setgid/sticky, contextual warnings, and generated chmod/chmod -R/chown/chgrp commands. Runs entirely in your browser.
Searchable TCP/UDP port reference — 51 common ports with default service, description, security notes, and typical attack relevance, filterable by category (Windows, Linux, Database, Web, Authentication, File Sharing). Runs entirely in your browser.
Offline reference for 45 common file formats, plus optional local file inspection — drag in a real file (or paste hex bytes) and this identifies its actual format from its magic bytes, flags an extension mismatch, and inspects ZIP-based container formats (docx/xlsx/pptx/jar/apk) by their real entry names. Runs entirely in your browser; your file is not uploaded.
Offline reference for all 62 IANA-registered HTTP status codes — search by code, name, category, or keyword, with RFC references, causes, fixes, a troubleshooting checklist per status class, and — for the codes people mix up most (401/403, 301/302/307/308, 409/422, 500/502/503/504) — reverse-proxy/gateway context, API-client notes, and browser-specific behavior. Runs entirely in your browser.
Look up the vendor/manufacturer of a MAC address using the official IEEE OUI registry (53,000+ assignments). Runs entirely in your browser.
Enter an IPv4 address and CIDR prefix to get the subnet mask, network/broadcast addresses, usable host range, and address count. Runs entirely in your browser.
Convert between Unix epoch timestamps and human-readable dates, shown in both UTC and your browser's local time explicitly. Runs entirely in your browser.
DNS, certificates, and scheduling — the parts of cloud infrastructure that are protocol-level, not vendor-specific.
Enter an IPv4 address and CIDR prefix to get the subnet mask, network/broadcast addresses, usable host range, and address count. Runs entirely in your browser.
Look up A, AAAA, CNAME, MX, TXT, NS, SOA, CAA, SRV, DMARC, and DKIM (with an optional selector) records for any hostname or IP, against Cloudflare, Google, Quad9, or a custom resolver — with TTL, response time, per-record copy, and JSON export. Requires a live network request.
Compare what Cloudflare, Google, and Quad9's public resolvers currently return for a hostname, side by side, with TTL and response time per resolver and mismatches highlighted. Requires a live network request.
Look up a domain's registrar, creation/updated/expiry dates, status codes, and nameservers by following the real IANA WHOIS referral chain, with the full raw response and a privacy-redaction indicator. Requires a live network request.
Inspect a live server's real TLS certificate chain — subject, issuer, SAN entries, validity, fingerprints, and flags for expired, self-signed, weak-key, or hostname-mismatched certificates. Requires a live network request.
Grades a URL's HTTP security headers (HSTS, CSP, X-Frame-Options, Permissions-Policy, and the cross-origin trio) against OWASP's own baseline, with a plain-English explanation of what each one protects against and why a missing one matters.
Build a standard 5-field cron expression visually or by hand, validate it, and preview the next 10 actual run times in your browser's local timezone. Runs entirely client-side.
A reference for translating common commands between Bash/Linux, Windows CMD, and PowerShell — closest equivalents, real syntax differences, and platform limitations, without pretending commands are identical when they're not. Runs entirely in your browser.
A client-side jq-like expression playground — field selection, pipes, object/array construction, map(), select(), sort_by(), group_by(), and more, evaluated by a hand-written interpreter (no WASM, no server). Shows parsed output, errors, and execution time. Runs entirely in your browser.
Paste JSON to validate, pretty-print, or minify it. Runs entirely in your browser — nothing is sent anywhere.